27

If you follow the pattern of allowing users access to your application without having confirmed an email (generally considered good UX), how do handle the case where they forgot their password? Very important in this particular case as the site includes personal health information.

Clearly, sending them an email with instructions to reset it is not appropriate, as their email is not yet verified. I came up with four solutions, but like none of them.

  1. Freeze a user out after, say, 1 week if they haven't confirmed their email. Then, during this one-week grace period, they cannot recover their email. (Somewhat problematic because it's a security issue to reveal whether an email address is registered during forgot password, so we'd be unable to actually communicate that password reset is unavailable to them based on not having confirmed).

  2. Add "security question" to signup. Bad for fairly obvious reasons.

  3. Just not let them use the site without confirming their email. Also bad.

  4. Just let them recover their password even without a confirmed email, but add some text in the site "if you haven't confirmed your email, someone could get access to your private health information." This would show in a banner at the top of the screen until they register, and have the option to have the email re-sent to any email address they choose. This might be the worst security case of all.

Any ideas?

Improve this question

9 Answers 9

Reset to default
16

Don't ask for a password until the email address has been confirmed.

Problem gone!

Use the process of gradual engagement and start it off by asking only for the email address.

In the meantime, invite them to browse the site or guide through some introductory information, but don't let them do anything security related until the email has been confirmed.

Do give them a chance to view or change the email address or resend the confirmation email if necessary (eg it doesn't turn up for some reason).

Here's the signup form from Gravatar

enter image description here

Edit: Gravatar tell me that the biggest downside to this mechanism is account recovery for people who have subsequently lost access to an email address and haven't bothered to register another email address that would help them get identified.

Improve this answer
3
  • Good point, except it will require a one more step (sign up, confirm and then complete with password) it may worth it!
    – alexeypegov
    Dec 9, 2012 at 13:39
  • More, but smaller steps is the concept behind gradual engagement. You ask only for what's necessary - as and when it's necessary. Maybe it's not possible 100% of the time and doesn't fit 100% of business goals but it's something to strive for where possible and may have benefits of increasing conversion and retaining customers longer if the process is easier. Having said that, there are lots of other factors that can play a part. For example, decreased sense of investment and loss for a customer if you annoy them and they want to go elsewhere.
    – Roger Attrill
    Dec 9, 2012 at 14:57
  • 5
    A minor cheat: If a user clicks "forgot your password?" on an unconfirmed email, the account should switch to "confirmed" once the user resets their password (since they did so using a link within the email you sent them).
    – Brian
    Dec 10, 2012 at 21:56
4

The simple answer is that you shouldn't allow a password reset (in any way) if the email address has not been confirmed and you care about security.

Secret questions are just another much less secure version of a password, and massively harm security.

The only real option it to resend an email confirmation. However, you should not let anyone log into an account unless the email is confirmed. If you do this, you won't have this problem in the first place.

Improve this answer
8
  • Can you explain why letting them using the site without confirmation is so bad?
    – Dvir Adler
    Dec 9, 2012 at 6:13
  • 1
    If you need to have a password to use a site in the first place, then you need to have some secure way of resetting that password. Without confirmation, this isn't possible.
    – JohnGB ♦
    Dec 10, 2012 at 2:04
  • A random person shouldn't be able to reset my password. They can try, but they shouldn't succeed. On the other hand, I myself should be able to reset my password, without knowing the password. Therefore, it is 100% necessary that there is something that is different between me and that random person. The difference can be a verified email address, or a verified phone number, for example. But there MUST be some difference.
    – gnasher729
    Jan 9, 2017 at 16:40
  • Usually you make confirming the email address the last and necessary step for creating an account. Consider the case where they didn't confirm the email address because it was mistyped. You mustn't let them create the account in that case, or there will be trouble.
    – gnasher729
    Jan 9, 2017 at 16:41
  • 1
    The issue with allowing password resets on accounts with a non-verified email address is that the actual owner of that email address could then access the account. As an example, in the case where an email address is mis-typed, the account creator should not want the owner of that mistyped email address to be allowed to access his account (via a password reset).
    – ajbeaven
    Dec 20, 2022 at 21:37
2

If your site has other features, let a logged in user access those features without a confirmed email. But as soon as they want to link to confidential information require a confirmed email.

Improve this answer
2

I think that you may try to resend the confirmation e-mail in a case of forgotten password. So, user will get a new confirmation at the old e-mail (specified at the registration step) and after confirmation he or she will be able to reset the password using standard procedure.

And you may also limit functionality somehow (let users read but not let them write, etc) until confirmation. It will motivate users to confirm their e-mails quickly and be sure e-mail was entered correctly, etc.

Improve this answer
2
  • I appreciate the reply, but I don't think this is actually acceptable. If the user mistyped their email in registration and asks for an email to reset their password, if another person actually has the email they typed incorrectly, they could then create a new password and gain access to the user's private health information.
    – cminu
    Dec 8, 2012 at 20:54
  • 1
    @cminu I can't figure out a solution for this case. The user may reregister then, I believe. Or it will become a risky game: you have no guarantee that's the same user who registered and there is no way to find it out (at least without security questions, etc).
    – alexeypegov
    Dec 8, 2012 at 21:13
2

As bad as it seems to be, 3 is the only sensible option, especially if personal information is involved. If the user doesn't understand the importance of this, he may be going to copy and paste his health record to his Facebook account, so you may want to keep him out, anyway...

I get the catch-all mailbox for my registered domain, i.e. the mailbox where each and any mail goes when the mailbox name or an alias for it doesn't exist. Regularly, I get exactly these mails there: You registered for our service, please confirm. It mostly seem to be the same 2 or 3 users who want to register for some gaming sites by using a fake mail address, choosing my domain for it.

Of course I never confirm. If they're going to do anything illegal, then the service would have my confirmed mail address linked to my domain. If they want to play there, then they can do it under their own address. And that's another reason to not allow the user to do anything: To protect the innocent mail address owners. If I wouldn't get the catchall, I wouldn't even know about this.

If I would be malicious, I could simply try to reset their password, entering their account. A decade ago or so, I had a mail where the service didn't require a confirmation, but instead sent the account name together with the initial, user-chosen password in plain text as a registration confirmation...

Improve this answer
2

I just want to check that I understand the situation you're worried about:

  1. They signed up on the site and provided an email address.
  2. The system sent an email to this address, requesting that they click a link.
  3. They didn't click the link.
  4. Later, they want to get into the site but they've forgotten the password.

Now, you say:

Clearly, sending them an email with instructions to reset it is not appropriate, as their email is not yet verified.

I'm not so sure. Either: 1. They actually input their email incorrectly, and neither the confirmation email, nor the password reset will get to the correct person; or 2. They typed it right, and probably the confirmation email made it, and so would a password reset email.

It sounds like you're worried that the fact that they hadn't previously clicked the confirmation button is somehow a security weakness in itself?

In case 1, they're stuck. They never provided us any information that lets us verify them. If personal health information is at stake, I don't think you can sacrifice security for "good UX".

In case 2, provide an option to resend the confirmation email. Perhaps you ask them to tell you their email address again (if it's not their login.)

Improve this answer
1

It's more of a question which i have in my mind (containing some answer to all other answers talking about security), that i add to the answer list... and i'm adding to the already asked question complexity.

There are so many ways we are reviewed here... but every single one has a flow, let review:

  1. I won't let user to perform forget password.
    • The account with forgotten password is lost in the space with all it's post
  2. I send email confirmation at begin (after registration).
    • The system may fails to send that email
    • User may ignore our website for the time begin, and come back when the email is lost
  3. I send email confirmation at begin, but i resend another confirmation if user lost the confirmation email (which naturally tokens have time limits and by default they expire by that time)
    • if user (hacker) has access to email address to reset the forgotten password, then he should also have access to confirm it, why care about it?
  4. If you wanna allow gradual profile completion?
    • It's more like you are creating social network, and want to disallow banned users, or more of similar cases, and some special cases, otherwise your user mostly require access to main functionality right-away, when they register.
  5. Security question?
    • Everyone says it's bad... i have not much of a logical clue, but mostly people with bad intentions are close to you...

And... lot of other cases that may "hit the wall" (fails), So, either the user loss account and later, they have to use secondary email, which they won't remember the next time... (Most client are not as intelligent as we are) (they are but they don't care to try or learn), because their primary email is blocked with a password forgotten account, Or the security will be low, or we have to remove account and recreate whole data, or force user to use email confirmation (which he may leave) on every login try or reset password, and so on.....

We have so many solution that have their ups and downs.

So what's the best solution? comment please...

i want to know your choices too

Update

BTW, there is one more informational cases to consider....

If user forgetting his password:

  1. User automatically confirms, that the mail address is his own mail address, when he request for the "Reset Password Link", since he can only activate the reset password link through his email, and he won't get the key otherwise, and as i said before if the mail or mail server are compromised, then it's over for him either way.
Improve this answer
1

I have run into this problem recently. The user thinks to have confirmed his/her email (when they actually never did). My suggestion is that you resend the confirmation email, so they expect a rest password email but receive a confirmation email which could read like this:

Hi, you requested a new password but your email still needs to be confirmed. Complete this last step and join (company name)! CTA Join (company name)

This case works if their email approval is still pending in the system, which in our case is only for 30 days. After that the email confirmation is no longer valid and they need to re-register again. In this case, if the user behaves the same so: tries to sign-in, fails, tries to recover the password, then you could send an email like this:

It looks like you tried to sign in to (company name), but don’t have an account quite yet. Follow the link to set one up in minutes. Create Account

The CTA would bring the user to the registration page where they enter their email to receive the confirmation email.

Improve this answer
0

When the user signs up for your Account (without E-mail Conformation) I would do the Following:

  • Ask him for an external E-mail or his Phone Number If he forgot his original E-mail (there is no confirmation for a Phone Number)
  • I would add an Security Question with an hint (The big Guys Google and Yahoo add Security Questions in their services)
  • And the last thing I would do is warn the user before you start using your service you need confirm you E-mail (In plain english you won't be allowed to use the service only when you confirm your E-mail (it will make your life easier)

I am Done :)

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.